Operations management system, operations management method and program thereof

ABSTRACT

An operations management system includes a correlation model storing unit, an analysis order storing unit, an analysis unit, and an order control unit. The correlation model storing unit stores a correlation model which indicates a correlation among plural types of performance values, for each of plural systems. The analysis order storing unit stores a detection order in the plural systems for carrying out detection of correlation destruction. The analysis unit carries out, in each of plural time periods, detection of whether the correlation destruction of the correlation included in the correlation model of each of the plural systems is caused or not by use of performance values inputted for the each of plural time periods, on the basis of the detection order. The order control unit updates the detection order in the each of plural time periods.

TECHNICAL FIELD

The present invention relates to an operations management system, anoperations management method and a program thereof, and in particular,relates to an operations management system, an operations managementmethod and a program thereof which detects a fault of a system.

BACKGROUND ART

An example of an operations management system, which detects a fault ofa system through generating a system model from time-domain sequentialinformation on system performance and using the generated system model,is disclosed in a patent literature 1.

According to the operations management system disclosed in the patentliterature 1, on the basis of measured values of plural types ofperformance values on the system, a correlation function for each pairof the plural types is determined, and then a correlation modelincluding a plurality of the determined correlation functions isgenerated. Then, the operations managing system judges, by use of thegenerated correlation model, whether correlation destruction is causedin measured performance values inputted newly, and identifies a cause ofthe fault through detecting the performance type which causes theconverged correlation destruction. As mentioned above, the art toanalyze the cause of the fault on the basis of the correlationdestruction is called invariant analysis.

Since the invariant analysis focuses on not largeness of the performancevalue but the correlation between the performance values, the invariantanalysis has advantages that it is unnecessary to set a threshold value,and it is possible to detect the fault which cannot be detected by useof the threshold, and it is easy to identify the abnormal cause, etc. incomparison with a case of detecting the fault through comparing eachperformance value with a threshold value.

In the case that the invariant analysis is carried out for a pluralityof analyzed systems, for example, for several tens analyzed systems allover the country, investment cost increases if an analysis apparatus,which carries out the invariant analysis, is arranged in every analyzedsystem.

Then, a method that one analysis apparatus, which is arranged in a datacenter or the like managing the systems all over the country and whichworks for a plurality of the analyzed systems, carries out the invariantanalysis for each of the plural analyzed systems, sequentially, isconceived.

CITATION LIST Patent Literature

[Patent Literature 1] Japanese Patent Application Laid-Open No.2009-199533

SUMMARY OF INVENTION Technical Problem

However, in the case that one analysis apparatus carries out theinvariant analysis described in the patent literature 1, for each of theplural analyzed systems, sequentially, there is a problem that it isdelayed to detect the fault of the system whose analysis order isscheduled latterly and consequently it is impossible to inform and toexecute a countermeasure suitably.

For example, in the case that it takes several seconds to carry out theinvariant analysis for each analyzed system since each analyzed systemincludes a large number of servers, it takes several minutes to detectthe fault of the system, whose analysis order is scheduled latterly,when the invariant analysis is applied to several tens analyzed systems.

An object of the present invention is to provide an operationsmanagement system, an operations management method and a program thereofwhich are able to decrease the delay in detecting the fault, in theinvariant analysis applied to a plurality of the analyzed systems.

Solution to Problem

An operations management system according to an exemplary aspect of theinvention includes correlation model storing means for storing acorrelation model which indicates a correlation among plural types ofperformance values, for each of plural systems, analysis order storingmeans for storing a detection order in the plural systems for carryingout detection of correlation destruction, analysis means for carryingout, in each of plural time periods, detection of whether thecorrelation destruction of the correlation included in the correlationmodel of each of the plural systems is caused or not by use ofperformance values inputted for the each of plural time periods, on thebasis of the detection order, and order control means for updating thedetection order in the each of plural time periods.

An operations management method according to an exemplary aspect of theinvention includes storing a correlation model which indicates acorrelation among plural types of performance values, for each of pluralsystems, storing a detection order in the plural systems for carryingout detection of correlation destruction, carrying out, in each ofplural time periods, detection of whether the correlation destruction ofthe correlation included in the correlation model of each of the pluralsystems is caused or not by use of performance values inputted for theeach of plural time periods, on the basis of the detection order, andupdating the detection order in the each of plural time periods.

A computer readable storage medium according to an exemplary aspect ofthe invention, records thereon a program, causing a computer to performa method including storing a correlation model which indicates acorrelation among plural types of performance values, for each of pluralsystems, storing a detection order in the plural systems for carryingout detection of correlation destruction, carrying out, in each ofplural time periods, detection of whether the correlation destruction ofthe correlation included in the correlation model of each of the pluralsystems is caused or not by use of performance values inputted for theeach of plural time periods, on the basis of the detection order, andupdating the detection order in the each of plural time periods.

Advantageous Effect of Invention

An effect of the present invention is that it is possible to decreasethe delay in detecting the fault, in the invariant analysis applied to aplurality of the analyzed systems.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 A block diagram showing a typical configuration of a firstexemplary embodiment of the present invention.

FIG. 2 A block diagram showing a configuration of an operationsmanagement system 1 according to the first exemplary embodiment of thepresent invention.

FIG. 3 A flowchart showing a process carried out by the operationsmanagement system 1 according to the first exemplary embodiment of thepresent invention.

FIG. 4 A flowchart showing details of a correlation destructiondetection process (Step S102) carried out by the operations managementsystem 1 according to the first exemplary embodiment of the presentinvention.

FIG. 5 A diagram showing an example of performance sequence information221 according to the first exemplary embodiment of the presentinvention.

FIG. 6 A diagram showing an example of a correlation model 222 accordingto the first exemplary embodiment of the present invention.

FIG. 7 A diagram showing an example of correlation destructioninformation 223 according to the first exemplary embodiment of thepresent invention.

FIG. 8 A diagram showing an example of a correlation destruction pattern224 according to the first exemplary embodiment of the presentinvention.

FIG. 9 A diagram showing an example of calculating a degree ofabnormality according to the first exemplary embodiment of the presentinvention.

FIG. 10 A diagram showing an example of degree of abnormalityinformation 421 according to the first exemplary embodiment of thepresent invention.

FIG. 11 A diagram showing an example of analysis order information 422according to the first exemplary embodiment of the present invention.

FIG. 12 A diagram showing an example of the correlation destructiondetection process carried out in each time period according to the firstexemplary embodiment of the present invention.

FIG. 13 A diagram showing an example of calculating a detection orderaccording to the first exemplary embodiment of the present invention.

FIG. 14 A diagram showing another example of the analysis orderinformation 422 according to the first exemplary embodiment of thepresent invention.

FIG. 15 A block diagram showing a configuration of an operationsmanagement system 1 according to a second exemplary embodiment of thepresent invention.

FIG. 16 A flowchart showing a process carried out by the operationsmanagement system 1 according to the second exemplary embodiment of thepresent invention.

FIG. 17 A diagram showing an example of unanalyzed system information423 according to the second exemplary embodiment of the presentinvention.

FIG. 18 A diagram showing an example of a correlation destructiondetection process carried out in each time period according to thesecond exemplary embodiment of the present invention.

FIG. 19 A diagram showing an example of calculating a detection orderaccording to the second exemplary embodiment of the present invention.

FIG. 20 A diagram showing an example of calculating the detection orderaccording to the second exemplary embodiment of the present invention.

FIG. 21 A diagram showing an example of calculating the detection orderaccording to the second exemplary embodiment of the present invention.

FIG. 22 A diagram showing an example of a correlation destructiondetection process carried out in each time period according to a thirdexemplary embodiment of the present invention.

FIG. 23 A diagram showing an example of calculating a detection orderaccording to the third exemplary embodiment of the present invention.

FIG. 24 A diagram showing an example of calculating the detection orderaccording to the third exemplary embodiment of the present invention.

FIG. 25 A diagram showing an example of calculating the detection orderaccording to the third exemplary embodiment of the present invention.

DESCRIPTION OF EMBODIMENTS First Exemplary Embodiment

Next, a first exemplary embodiment according to the present inventionwill be described.

Firstly, a configuration according to the first exemplary embodiment ofthe present invention will be described. FIG. 2 is a block diagramshowing a configuration of an operations management system 1 accordingto the first exemplary embodiment of the present invention.

With reference to FIG. 2, the operations management system 1 accordingto the first exemplary embodiment of the present invention includes aplurality of analyzed systems 100 (100 a, 100 b, 100 c . . . ), aplurality of analysis control units 200 (200 a, 200 b and 200 c . . . ),an analysis unit 300 and an order control unit 400.

The analyzed system 100 includes one or more monitored apparatuses, suchas a Web server, an application server and a database server, whichcompose the analyzed system.

The analysis control units 200 are connected with analyzed systems 100,respectively. The analysis control unit 200 generates a correlationmodel 222 on the analyzed system 100. Moreover, the analysis controlunit 200 outputs an analysis result to a user and executes acountermeasure against a detected fault.

The analysis control unit 200 includes a performance informationcollecting unit 201, a correlation model generating unit 202, anadministrator interaction unit 203, a countermeasure execution unit 204,a performance information storing unit 211, a correlation model storingunit 212, a correlation destruction storing unit 213 and a correlationdestruction pattern storing unit 214.

Here, the performance information collecting unit 201 collects, fromeach monitored apparatus included in the analyzed system 100, measureddata (measured values) of performance values of plural items measured inthe monitored apparatus at a predetermined time interval. As the item ofthe performance value, for example, a rate of using CPU (CentralProcessing Unit) (abbreviated as CPU), an amount of used memory(abbreviated as MEM), an amount of used disk (abbreviated as DSK) or thelike is collected. Here, a set of the monitored apparatus and the itemof the performance value is defined as a type of the performance value(performance type (or abbreviated as type)), and a set of the pluraltypes of the performance values measured at the same time is defined asperformance information. The performance information collecting unit 201makes the performance information storing unit 211 store a time-domainsequential change of the performance information as performance sequenceinformation 221.

FIG. 5 is a diagram showing an example of the performance sequenceinformation 221 according to the first exemplary embodiment of thepresent invention. According to the example in FIG. 5, the performancesequence information 221 includes a rate of using CPU (SV1.CPU), anamount of used memory (SV1.MEM), and an amount of used disk (SV1.DSK) ofthe monitored apparatus with apparatus identifier SV1, a rate of usingCPU (SV2.CPU) of the monitored apparatus 200 with apparatus identifierSV2, or the like as the performance type.

The correlation model generating unit 202 generates the correlationmodel 222 of the analyzed system 100 on the basis of the performancesequence information 221. Here, the correlation model generating unit202 determines a correlation function (conversion function), whichindicates a correlation for a pair of performance types out of theplural performance types, on the basis of the performance informationcollected at a predetermined time interval, which is included in theperformance sequence information 221, and generates the correlationmodel 222 which is a set of the determined correlation functions. Thecorrelation function estimates, on the basis of a time-domain sequenceof measured values of one performance type, a time-domain sequence ofperformance values of another performance type. The correlation functionis determined in the system identifying process, which is applied to thetime-domain sequences of the measured values of a pair of performancetypes, as shown in the patent literature 1. The correlation modelgenerating unit 202 may calculate a weight for each correlation functionon the basis of an average value of a conversion error which is causedby the correlation function. Here, the weight becomes small as anaverage value of the conversion error becomes large. Then, thecorrelation model generating unit 202 may make the correlation model 222include only the correlation function which has the weight larger than apredetermined value.

The correlation model storing unit 212 stores the correlation model 222generated by the correlation model generating unit 202.

FIG. 6 is a diagram showing an example of the correlation model 222according to the first exemplary embodiment of the present invention. InFIG. 6, each node means the performance type, and an arrow indicated bya solid line between the nodes means the correlation from one to theother out of two performance types. The correlation function (not shownin the figure) is determined for each of these correlations.

The correlation destruction storing unit 213 stores correlationdestruction information 223 which is a result of correlation destructiondetection in the correlation model 222 and which is acquired from theanalysis unit 300.

FIG. 7 is a diagram showing an example of the correlation destructioninformation 223 according to the first exemplary embodiment of thepresent invention. The correlation destruction information 223 isgenerated every measurement time of the performance information, andincludes the measurement time of the performance information which is atarget for the correlation destruction detection, the correlation (inputand output) which is included in the correlation model 222, and acorrelation destruction detection result per each correlation. In thecorrelation destruction detection result, “o” means that the correlationdestruction is not caused, and “x” means that the correlationdestruction is caused. FIG. 7 shows an example of the result of thecorrelation destruction detection for the correlation model 222 shown inFIG. 6.

The correlation destruction pattern storing unit 214 stores acorrelation destruction pattern 224 which is used for calculating adegree of signaling fault in the analysis unit 300.

FIG. 8 is a diagram showing an example of the correlation destructionpattern 224 according to the first exemplary embodiment of the presentinvention. As shown in FIG. 8, the correlation destruction pattern 224includes one or more sets of an identifier assigned to a past fault(fault identifier), and a list of the correlation destruction detectionresult for each correlation when the fault was caused. FIG. 8 shows theexample of the correlation destruction pattern 224 for the correlationmodel 222 shown in FIG. 6.

The administrator interaction unit 203 informs an administrator or thelike of the correlation destruction detection result which is acquiredfrom the analysis unit 300, and receives an instruction, which theadministrator issues, such as a countermeasure against the fault.

The countermeasure execution unit 204 executes the countermeasure, whichis instructed by the administrator, on the analyzed system 100.

The analysis unit 300 is connected with a plurality of analysis controlunits 200 (200 a, 200 b, . . . ), and carries out detection of thecorrelation destruction on the correlation in the correlation model 222of each of the plural analyzed systems 100 (100 a, 100 b, . . . ).

The analysis unit 300 includes a correlation destruction detection unit301.

The correlation destruction detection unit 301 carries out the detectionof the correlation destruction on the correlation included in thecorrelation model 222 of each of the plural analyzed systems 100, ineach of plural time periods which are continuous in the time domain. Ineach time period, the correlation destruction detection unit 301acquires the performance information to be analyzed, from theperformance information storing unit 211 of the analysis control unit200, and carries out the correlation destruction detection for theperformance information, sequentially.

Here, a time length of each time period may be the same as theabove-mentioned time interval for collecting the performance value. Inthis case, the correlation destruction detection unit 301 acquiresperformance information collected newly from the performance informationstoring unit 211 in each time period, and then, carries out thecorrelation destruction detection.

The correlation destruction detection unit 301, similarly to the artdescribed in patent literature 1, detects the correlation destruction ofthe correlation included in the correlation model 222, by use of theperformance information to be analyzed and the correlation model 222stored in the correlation model storing unit 212. The correlationdestruction detection unit 301 calculates a difference between a valueobtained through inputting a measured value of one of a pair ofperformance types included in the performance information to be analyzedinto a correlation function related to the pair of performance types,and a measured value of the other of the pair of performance types.Then, the correlation destruction detection unit 301 judges that thecorrelation destruction for the pair of performance types is caused ifthe difference is equal to or greater than a predetermined value.

The correlation destruction detection unit 301 carries out thecorrelation destruction detection for each analyzed system 100sequentially, on the basis of “order of the correlation destructiondetection” in the plural analyzed systems 100, which is indicated byanalysis order information 422 acquired from the order control unit 400.In the first exemplary embodiment of the present invention, it isassumed that carrying out the correlation destruction detection for allanalyzed systems 100 is completed within each time period.

Furthermore, the correlation destruction detection unit 301 calculates adegree of abnormality of each analyzed system 100 on the basis of thedetected correlation destruction, and sends the degree of abnormality tothe order control unit 400. Here, the correlation destruction detectionunit 301 calculates “a degree of correlation destruction” and “a degreeof signaling fault” as the degree of abnormality.

The degree of correlation destruction indicates an extent of thecorrelation destruction in the correlation model 222. In the exemplaryembodiment of the present invention, the number of the correlations, onwhich the correlation destruction is detected by the correlationdestruction detection unit 301, out of the correlations included in thecorrelation model 222 is used as the degree of correlation destruction.In the case that the degree of correlation destruction is large, it isestimated that there is a possibility that the fault is caused in theanalyzed system 100.

FIG. 9 is a diagram showing an example of calculating the degree ofabnormality according to the first exemplary embodiment of the presentinvention. For example, in the case that, as shown in FIG. 7,correlation destruction is detected on five correlations in thecorrelation model 222 in FIG. 6 by the correlation destruction detectionunit 301, the degree of correlation destruction is 5 as shown in FIG. 9.

The degree of correlation destruction has a tendency to become large asthe number of the correlations included in the correlation model 222 ofthe analyzed system is large.

Here, the correlation destruction detection unit 301 may use a valuecalculated with another method as the degree of correlation destruction,as far as the value indicates the degree of correlation destruction. Forexample, the correlation destruction detection unit 301 may use a totalof weights assigned to the correlations on each of which the correlationdestruction is detected, as the degree of correlation destruction.

The degree of signaling fault indicates similarity (degree ofsimilarity) between the result of the correlation destruction detectionby the correlation destruction detection unit 301, and the result of thecorrelation destruction detection at a time when the fault was caused inthe past. In the exemplary embodiment of the present invention, a degreeof coincidence between a result of judging whether the correlationdestruction is detected or not for each of the correlations by thecorrelation destruction detection unit 301, and a result of judgingwhether the correlation destruction is detected or not for each of thecorrelation in the correlation destruction pattern 224, is used as thedegree of signaling fault. When the degree of coincidence is large, itis considered that there is a possibility that the same fault as thefault indicated by the correlation destruction pattern 224 is caused atthis moment or will be caused in the future in the analyzed system 100.

For example, in the case that, for the correlation model 222 shown inFIG. 6, correlation destruction is detected on five correlations asshown in FIG. 7, and the correlation destruction pattern 224 is set asshown in FIG. 8, results of judging whether the correlation destructionis detected or not are coincident for 8 correlations, as shown in FIG.9. In this case, the degree of coincidence on the result of judgingwhether the correlation destruction is detected or not is equal to 80%through dividing the number of the correlations for which the results ofjudging whether the correlation destruction is detected or not iscoincident by the number of the correlations.

The degree of signaling fault has a tendency to become large as thenumber of the correlations included in the correlation model 222 of theanalyzed system is small.

Here, the correlation destruction detection unit 301 may use a valuecalculated with another method as the degree of signaling fault, as faras the value indicates the similarity (degree of similarity) between theresult of the correlation destruction detection by the correlationdestruction detection unit 301 and the result of the correlationdestruction detection at a time when the fault was caused in the past.For example, the correlation destruction detection unit 301 may find outthe similarity of the correlation on which the correlation destructionis detected through comparing the correlations on each of which thecorrelation destruction is detected, in stead of comparing the resultsof judging whether the correlation destruction is detected or not, andthen use the similarity as the degree of signaling fault. Moreover, thecorrelation destruction detection unit 301 may divide the correlationsinto some groups, and find out the similarity on distribution of thenumber of the correlations on which the correlation destruction isdetected, per the group, and use the similarity as the degree ofsignaling fault.

The order control unit 400 is connected with the analysis unit 300. Theorder control unit 400 determines and updates an order of thecorrelation destruction detection in a plurality of the analyzed systems100.

The order control unit 400 includes an analysis order determination unit401, a degree of abnormality storing unit 411 and an analysis orderstoring unit 412.

The analysis order determination unit 401 determines the order ofcarrying out the correlation destruction detection in a plurality of theanalyzed systems 100 on the basis of the degree of abnormality of eachanalyzed system 100, which is stored in the degree of abnormalitystoring unit 411, in each of the plural time periods mentioned above,and updates the analysis order information 422 which is stored in theanalysis order storing unit 412.

The degree of abnormality storing unit 411 stores degree of abnormalityinformation 421 which indicates the degree of abnormality of eachanalyzed system 100, which is acquired from the analysis unit 300. FIG.10 is a diagram showing an example of the degree of abnormalityinformation 421 according to the first exemplary embodiment of thepresent invention. As shown in FIG. 10, the degree of abnormalityinformation 421 includes an identifier of the analyzed system 100(system identifier), and the degree of correlation destruction and thedegree of signaling fault which are defined as the degree of abnormalityof the analyzed system 100.

The analysis order storing unit 412 stores the analysis orderinformation 422 which indicates the order of carrying out thecorrelation destruction detection in the plural analyzed systems 100.Here, the order of carrying out the correlation destruction detection isdetermined by the analysis order determination unit 401. FIG. 11 is adiagram showing an example of the analysis order information 422according to the first exemplary embodiment of the present invention. Asshown in FIG. 11, the analysis order information 422 includes the systemidentifier of the analyzed system 100 and the order of carrying out thecorrelation destruction detection of the analyzed system 100.

Here, each of the analysis control unit 200, the analysis unit 300 andthe order control unit 400 may be a computer which includes CPU and astorage medium which stores a program, and works with control based onthe program.

Here, the analysis unit 300 and the order control unit 400 may bearranged in one apparatus. Moreover, the analysis control unit 200 mayinclude the analyzed system 100.

Furthermore, a plurality of the analyzed systems 100 may be connectedwith one analysis control unit 200. In this case, the analysis controlunit 200 generates the correlation model 222 of each of the pluralanalyzed systems 100 and carries out the correlation destructiondetection for each of the plural analyzed systems 100. Moreover, in thiscase, the analysis control unit 200, the analysis unit 300 and the ordercontrol unit 400 may be arranged in one apparatus.

Next, an operation of the operations management system 1 according tothe first exemplary embodiment of the present invention will bedescribed.

FIG. 3 is a flowchart showing a process carried out by the operationsmanagement system 1 according to the first exemplary embodiment of thepresent invention. FIG. 12 is a diagram showing an example of acorrelation destruction detection process carried out in each timeperiod according to the first exemplary embodiment of the presentinvention.

Here, it is assumed that correlation model 222 of each analyzed system100 is generated by corresponding analysis control unit 200, and storedin the correlation model storing unit 212.

Firstly, in each of the plural time periods mentioned above, thecorrelation destruction detection unit 301 of the analysis unit 300acquires analysis order information 422 from the analysis order storingunit 412 of the order control unit 400 (Step S101).

For example, the correlation destruction detection unit 301 acquiresanalysis order information 422 shown in FIG. 11 in time period 1 shownin FIG. 12. Here, the detection order may be determined, for example, inan ascending order of the system identifiers of the analyzed systems 100as an initial state.

The correlation destruction detection unit 301 carries out thecorrelation destruction detection process on the basis of the acquiredanalysis order information 422 (Step S102).

FIG. 4 is a flowchart showing details of the correlation destructiondetection process (Step S102) carried out by the operations managementsystem 1 according to the first exemplary embodiment of the presentinvention.

The correlation destruction detection unit 301 repeats Steps S152 toS157 for each analyzed system 100, sequentially, according to theanalysis order storing unit 412 (Step S151).

The correlation destruction detection unit 301 acquires performanceinformation for the present time period, from the performanceinformation storing unit 211 of the analysis control unit 200 (StepS152). The correlation destruction detection unit 301 acquirescorrelation model 222 from the correlation model storing unit 212 of theanalysis control unit 200 (Step S153). The correlation destructiondetection unit 301 carries out the detection of correlation destructionon the correlations included in the correlation model 222, by use of theacquired performance information and the acquired correlation model 222(Step S154). The correlation destruction detection unit 301 stores theresult of the correlation destruction detection as the correlationdestruction information 223 in the correlation destruction storing unit213 of the analysis control unit 200 (Step S155).

The correlation destruction detection unit 301 calculates degree ofabnormality of the analyzed system 100 on the basis of the detectedcorrelation destruction (Step S156). The correlation destructiondetection unit 301 stores the calculated degree of abnormality as thedegree of abnormality information 421 in the degree of abnormalitystoring unit 411 of the order control unit 400 (Step S157).

For example, in time period 1 shown in FIG. 12, the correlationdestruction detection unit 301 carries out the correlation destructiondetection and calculates the degree of abnormality, in an order ofsystem identifiers S1, S2, S3 and S4 respectively, according to theanalysis order information 422 shown in FIG. 11, for performanceinformation d11, d21, d31 and d41 of time period 1 measured inrespective analyzed system 100. As a result, degree of abnormalityinformation 421, for each analyzed system 100, shown in FIG. 10 isstored in the degree of abnormality storing unit 411.

Next, the analysis order determination unit 401 of the order controlunit 400 acquires the degree of abnormality information 421 from thedegree of abnormality storing unit 411 (Step S103).

The analysis order determination unit 401 assigns an evaluation score(hereinafter, referred to as score), which is used for evaluating thedegree of abnormality, to each analyzed system 100 on the basis of thedegree of correlation destruction of each analyzed system 100 which isincluded in the degree of abnormality information 421 (Step S104). Theanalysis order determination unit 401 assigns a score to each analyzedsystem 100 on the basis of the degree of signaling fault of eachanalyzed system 100 which is included in the degree of abnormalityinformation 421 (Step S105). Here, the analysis order determination unit401 assigns a value, which becomes large according to an order of thedegree of correlation destruction or the degree of signaling fault inall analyzed systems 100, as the score on the degree of correlationdestruction or the degree of signaling fault, respectively.

FIG. 13 is a diagram showing an example of calculating the detectionorder according to the first exemplary embodiment of the presentinvention. For example, as shown in FIG. 13, the analysis orderdetermination unit 401 assigns the scores 4, 3, 2 and 1 to the analyzedsystems 100 with the system identifier S1, S4, S3 and S2, respectively,in an order of largeness of the degree of correlation destruction infour analyzed systems 100. Moreover, the analysis order determinationunit 401 assigns the scores 4, 3, 2 and 1 to the analyzed systems 100with the system identifiers S1, S3, S2 and S4, respectively, in an orderof largeness of the degree of signaling fault in four analyzed systems100.

Next, the analysis order determination unit 401 calculates a total scorebased on the degree of correlation destruction and the score based onthe degree of signaling fault per the analyzed system 100, anddetermines the order of carrying out the correlation destructiondetection in the plural analyzed systems 100 in such a way that thecorrelation destruction detection for the analyzed system 100 with thehigh total score is carried out early (Step S106). Then, the analysisorder determination unit 401 stores the determined detection order asthe analysis order information 422 in the analysis order storing unit412 (Step S107).

For example, as shown in FIG. 13, the analysis order determination unit401 calculates a total score per the analyzed object system 100, anddetermines the detection order for the analyzed systems 100 with thesystem identifiers S1, S3, S4 and S2 as 1, 2, 3, and 4, respectively, inan order of largess of the total score.

FIG. 14 is a diagram showing another example of the analysis orderinformation 422 according to the first exemplary embodiment of thepresent invention. The analysis order determination unit 401 stores(updates) the analysis order information 422 shown in FIG. 14 in theanalysis order storing unit 412. Here, in the case that a plurality ofthe analyzed systems 100 have the same total score, the analysis orderdetermination unit 401 may determine the detection order in such a waythat the detection may be carried out early for the analyzed system 100with the large degree of correlation destruction or the large degree ofsignaling fault.

Then, the correlation destruction detection unit 301 and the analysisorder determination unit 401 carry out Steps S101 to S107 repeatedly ineach of the plural time periods. At this time, the correlationdestruction detection unit 301 carries out the correlation destructiondetection and calculates the degree of abnormality on the basis of theanalysis order, information 422 stored in the analysis order storingunit 412.

For example, in time period 2 shown in FIG. 12, the correlationdestruction detection unit 301 caries out the correlation destructiondetection and calculates the degree of abnormality, in the order of thesystem identifiers S1, S3, S4 and S2 respectively, according to theupdated analysis order information 422 shown in FIG. 14, for performanceinformation d12, d32, d42 and d22 of time period 2 measured inrespective analyzed system 100.

As mentioned above, the detection order is updated in such a way thatthe correlation destruction detection for the analyzed systems with thesystem identifiers S3 and S4 having the higher evaluation score on thedegree of abnormality is carried out preferentially before thecorrelation destruction detection for the analyzed system with thesystem identifiers S2 having the lower evaluation score on the degree ofabnormality.

With that, the operation according to the first exemplary embodiment ofthe present invention is completed.

While the analysis order determination unit 401 calculates the scores onthe basis of the order of the degree of correlation destruction and theorder of the degree of signaling fault which are corresponding to thedegree of abnormality, and determines the detection order on the basisof the total score according to the first exemplary embodiment of thepresent invention, another method may be used as far as the detectionorder is determined on the basis of largeness of the degree ofabnormality. For example, the analysis order determination unit 401 maydetermine the detection order on the basis of an order of a total valueof the degree of correlation destruction and the degree of signalingfault.

Moreover, the analysis order determination unit 401 may use any one ofthe degree of correlation destruction and the degree of signaling faultas the degree of abnormality. Moreover, the analysis order determinationunit 401 may use another index calculated on the basis of the result ofthe correlation destruction detection as the degree of abnormality, inaddition to the degree of correlation destruction and the degree ofsignaling fault.

Next, a characteristic configuration of the first exemplary embodimentof the present invention will be described. FIG. 1 is a block diagramshowing a characteristic configuration according to the first exemplaryembodiment of the present invention.

Referring to FIG. 1, an operations management system 1 includes acorrelation model storing unit 212, an analysis order storing unit 412,an analysis unit 300, and an order control unit 400.

The correlation model storing unit 212 stores a correlation model 222which indicates a correlation among plural types of performance values,for each of plural systems.

The analysis order storing unit 412 stores a detection order in theplural systems for carrying out detection of correlation destruction.

The analysis unit 300 carries out, in each of plural time periods,detection of whether the correlation destruction of the correlationincluded in the correlation model of each of the plural systems iscaused or not by use of performance values inputted for the each ofplural time periods, on the basis of the detection order.

The order control unit 400 updates the detection order in the each ofplural time periods.

According to the first exemplary embodiment of the present invention, itis possible to decrease a delay in detecting the fault, in the invariantanalysis applied to a plurality of the analyzed systems 100. The reasonis that the order control unit 400 updates the detection order in eachof the plural time periods.

Moreover, according to the first exemplary embodiment of the presentinvention, it is possible to carry out detection of the fault for theanalyzed system 100 having a high possibility that the fault is causedat this moment or will be caused in the future, preferentially. Thereason is that the order control unit 400 determines the detection orderby use of the degree of abnormality which is derived from at least oneof the degree of correlation destruction calculated on the basis of thenumber of the correlations on which the correlation destruction has beendetected, and the degree of similarity between the result of thecorrelation destruction detection at a time when the analyzed system 100was in a state of the fault and the result of the correlationdestruction detection for the inputted performance values.

Moreover, according to the first exemplary embodiment of the presentinvention, it is possible to decrease the delay in detecting the faultregardless of a scale of the analyzed system 100. The reason is that theorder control unit 400 uses, as the degree of abnormality, a combinationof the degree of correlation destruction which has a tendency to becomelarge as the number of correlations included in the correlation model422 becomes large, and the degree of similarity between the results ofthe correlation destruction detection which has a tendency to becomelarge as the number of correlations included in the correlation model422 becomes small.

Second Exemplary Embodiment

Next, a second exemplary embodiment of the present invention will bedescribed.

In the second exemplary embodiment of the present invention, it isassumed that it is not always possible to carry out (complete) thecorrelation destruction detection for all the analyzed systems 100within each time period.

For example, in the case that the number of the analyzed systems 100 islarge, and the time interval at which the performance information iscollected is shorter than a time required for carrying out thecorrelation destruction detection for all analyzed systems 100, it isimpossible to carry out the correlation destruction detection for theanalyzed system 100 whose detection order is scheduled latterly, withineach time period. Moreover, in the case that the analysis unit 300 hasto carry out a process, whose processing time is time-variant, inaddition to the correlation destruction detection, it is impossible tocarry out the correlation destruction detection for the analyzed system100 whose detection order is scheduled latterly, in some time periods.

In this case, since the degree of abnormality is not updated for theanalyzed system 100 for which the correlation destruction detection isnot carried out in the configuration according to the first exemplaryembodiment of the present invention, there is a problem that a state, inwhich the correlation destruction detection is not carried out for theanalyzed system 100, continues.

Then, in the second exemplary embodiment of the present invention, avalue larger than the degree of abnormality calculated in a former timeperiod in which the correlation destruction detection was carried out isassigned to the degree of abnormality of the analyzed system 100 forwhich the correlation destruction detection has not been carried out. Bythis, it is possible to carry out the correlation destruction detectionfor the analyzed system 100 in preference to another analyzed system 100in the next time period.

Note that, in the second exemplary embodiment of the present invention,a component with the same reference sign as the component of the firstexemplary embodiment of the present invention is identical to thecomponent of the first exemplary embodiment, as far as there is nospecific description.

Firstly, a configuration according to the second exemplary embodiment ofthe present invention will be described. FIG. 15 is a block diagramshowing a configuration of an operations management system 1 accordingto the second exemplary embodiment of the present invention.

With reference to FIG. 15, the order control unit 400 of the operationsmanagement system 1 according to the second exemplary embodiment of thepresent invention includes an unanalyzed system storing unit 413 inaddition to the configuration according to the first exemplaryembodiment of the present invention.

The unanalyzed system storing unit 413 stores unanalyzed systeminformation 423 which indicates the analyzed system 100 for which thecorrelation destruction detection has not been carried out (unanalyzed)in each of the plural time periods mentioned above.

FIG. 17 is a diagram showing an example of the unanalyzed systeminformation 423 according to the second exemplary embodiment of thepresent invention. As shown in FIG. 17, the unanalyzed systeminformation 423 includes a list of sets of the system identifier of theanalyzed system 100 and unanalyzed times which indicates the number oftimes the correlation destruction detection was not carried out for theanalyzed system 100. The unanalyzed times is 0 in an initial state. Inthe case that the correlation destruction detection has been carriedout, the unanalyzed times is reset to 0.

The correlation destruction detection unit 301 of the analysis unit 300carries out the correlation destruction detection in each analyzedsystem 100, sequentially, on the basis of the detection order which isindicated by the analysis order information 422 acquired from the ordercontrol unit 400, in each of the plural time periods. According to thesecond exemplary embodiment of the present invention, the correlationdestruction detection unit 301 carries out the correlation destructiondetection not only for the performance information of the present timeperiod but also for the performance information of the former timeperiod in which the correlation destruction detection was not carriedout, collectively.

The analysis order determination unit 401 of the order control unit 400determines the order of carrying out the correlation destructiondetection in a plurality of the analyzed systems 100 on the basis of thedegree of abnormality of each analyzed system 100, which is stored inthe degree of abnormality storing unit 411, in each of the plural timeperiods mentioned above. According to the second exemplary embodiment ofthe present invention, the analysis order determination unit 401 assignsa value larger than the degree of abnormality calculated in the formertime period, in which the correlation destruction detection was carriedout, to the degree of abnormality of the analyzed system 100 for whichthe correlation destruction detection has not been carried out, anddetermines the order of carrying out the correlation destructiondetection on the basis of the degree of abnormality to which the valueis assigned. Specifically, the analysis order determination unit 401determines the order of carrying out the correlation destructiondetection using a value obtained through multiplying the degree ofabnormality calculated in the time period when the correlationdestruction detection was carried out by the unanalyzed times.

Next, an operation of the operations management system 1 according tothe second exemplary embodiment of the present invention will bedescribed.

FIG. 16 is a flowchart showing a process carried out by the operationsmanagement system 1 according to the second exemplary embodiment of thepresent invention. FIG. 18 is a diagram showing an example of acorrelation destruction detecting process carried out in each timeperiod according to the second exemplary embodiment of the presentinvention.

Firstly, in each of the plural time periods mentioned above, thecorrelation destruction detection unit 301 of the analysis unit 300acquires analysis order information 422 from the analysis order storingunit 412 of the order control unit 400 (Step S201).

For example, the correlation destruction detection unit 301 acquiresanalysis order information 422 shown in FIG. 11 in time period 1 shownin FIG. 18.

The correlation destruction detection unit 301 carries out thecorrelation destruction detection process on the basis of the acquiredanalysis order information 422 (Step S202).

Here, the correlation destruction detection unit 301 carries out thecorrelation destruction detection process shown as Step S151 to StepS157 shown in FIG. 4, for each analyzed system 100, sequentially,according to the analysis order storing unit 412.

However, the correlation destruction detection unit 301 stops theprocess at a time when the time period is expired, even if thecorrelation destruction detection process is not completed for someanalyzed systems 100.

In Step S152, in the case that the unanalyzed times of the analyzedsystem 100 is equal to or greater than 1 with reference to theunanalyzed system information 423, that is, in the case that thecorrelation destruction detection is not carried out for the analyzedsystem 100 in the former time period, the correlation destructiondetection unit 301 acquires not only the performance information of thepresent time period but also the performance information of the formertime period in which the correlation destruction detection was notcarried out, collectively. In Step S154, the correlation destructiondetection unit 301 carries out the correlation destruction detection forthe performance information of the former time period in which thecorrelation destruction detection was not carried out and theperformance information of the present time period, collectively. InStep S155, the correlation destruction detection unit 301 stores theresult of the correlation destruction detection for the time period inwhich the correlation destruction detection was not carried out and theresult of the correlation destruction detection for the present timeperiod in the correlation destruction storing unit 213, collectively.

Next, the correlation destruction detection unit 301 updates theunanalyzed system information 423 stored in the unanalyzed systemstoring unit 413 (Step S203). Here, the correlation destructiondetection unit 301 adds 1 to the unanalyzed times for the analyzedsystem 100 for which the correlation destruction detection process hasnot been completed in the time period, and sets 0 to the unanalyzedtimes for the analyzed system 100 for which the correlation destructiondetection process has been completed in the time period.

Each of FIG. 19, FIG. 20 and FIG. 21 is a diagram showing an example ofcalculating the detection order according to the second exemplaryembodiment of the present invention.

For example, in time period 1 shown in FIG. 18, the correlationdestruction detection unit 301 carries out the correlation destructiondetection and calculates the degree of abnormality in an order of thesystem identifiers S1, S2, S3 and S4 respectively, according to theanalysis order information 422 shown in FIG. 11.

Here, in the case that the correlation destruction detection process hasnot been carried out for the analyzed systems 100 with the systemidentifiers S3 and S4, the correlation destruction detection unit 301adds 1 to the unanalyzed times of the analyzed systems 100 with thesystem identifier S4 and S3 respectively, and sets 0 to the unanalyzedtimes of the other analyzed systems 100, as shown in FIG. 19.

In the correlation destruction detection process carried out for theanalyzed systems 100 with the system identifier S1 and S2, thecorrelation destruction detection unit 301 carries out the correlationdestruction detection for the performance information d11 and d21 oftime period 1 measured in the analyzed systems 100, respectively. Thecorrelation destruction detection unit 301 calculates the degree ofabnormality of the analyzed systems 100 with the system identifiers S1and S2 respectively, as shown in FIG. 19.

Next, the analysis order determination unit 401 of the order controlunit 400 acquires the degree of abnormality information 421 from thedegree of abnormality storing unit 411 (Step S204). The analysis orderdetermination unit 401 acquires the unanalyzed system information 423from the unanalyzed system storing unit 413 (Step S205).

The analysis order determination unit 401 assigns a score to eachanalyzed system 100 on the basis of the degree of correlationdestruction included in the degree of abnormality information 421 andthe unanalyzed times included in the unanalyzed system storing unit 413(Step S206). The analysis order determination unit 401 assigns a scoreto each analyzed system 100 on the basis of the degree of signalingfault included in the degree of abnormality information 421 and theunanalyzed times included in the unanalyzed system storing unit 413(Step S207). Here, for the analyzed system 100 having unanalyzed timeswhich is equal to or greater than 1, the analysis order determinationunit 401 calculates values through multiplying the degree of correlationand the degree of signaling fault included in the degree of abnormalityinformation 421 by the unanalyzed times respectively, and assigns scoresusing the calculated values similarly to the first exemplary embodiment.

For example, as shown in FIG. 19, the analysis order determination unit401 assigns the scores after multiplying the degree of correlationdestruction and the degree of signaling fault of the analyzed systemswith the system identifiers S3 and S4 by 1, respectively.

Next, the analysis order determination unit 401 determines the order ofcarrying out the correlation destruction detection in the pluralanalyzed systems 100 on the basis of the total score (Step S208). Then,the analysis order determination unit 401 stores the determineddetection order as the analysis order information 422 in the analysisorder storing unit 412 (Step S209).

For example, as shown in FIG. 19, the analysis order determination unit401 calculates a total score per the analyzed system 100, and determinesthe detection order for the analyzed systems 100 with the systemidentifiers S1, S2, S3 and S4 as 1, 2, 3, and 4, respectively, in anorder of largeness of the total score.

Then, the correlation destruction detection unit 301 and the analysisorder determination unit 401 carry out Steps S201 to S209 repeatedly ineach of the plural time periods.

For example, in time period 2 shown in FIG. 18, the correlationdestruction detection unit 301 caries out the correlation destructiondetection and calculates the degree of abnormality in an order of thesystem identifiers S1, S2, S3 and S4, respectively.

Here, in the case that the correlation destruction detection process hasnot been carried out for the analyzed systems with the systemidentifiers S3 and S4, the correlation destruction detection unit 301adds 1 to the unanalyzed times of the analyzed systems 100 with thesystem identifiers S3 and S4 respectively, and sets 0 to the unanalyzedtimes of the other analyzed systems 100, as shown in FIG. 20.

In the correlation destruction detection process carried out for theanalyzed systems 100 with the system identifier S1 and S2, thecorrelation destruction detection unit 301 carries out the correlationdestruction detection for the performance information d12 and d22 oftime period 2 measured in the analyzed systems 100, respectively. Thecorrelation destruction detection unit 301 calculates the degree ofabnormality of the analyzed systems 100 with the system identifiers S1and S2 respectively, as shown in FIG. 20.

As shown in FIG. 20, the analysis order determination unit 401 assignsthe scores after multiplying the degree of correlation destruction andthe degree of signaling fault of the analyzed systems with the systemidentifiers S3 and S4 by 2, respectively. The analysis orderdetermination unit 401 determines the detection order for the analyzedsystems 100 with the system identifiers S1, S2, S3 and S4 as 1, 3, 2,and 4, respectively, on the basis of the total score.

Then, in time period 3 shown in FIG. 18, the correlation destructiondetection unit 301 caries out the correlation destruction detection andcalculates the degree of abnormality in an order of the systemidentifiers S1, S3, S2 and S4, respectively.

Here, in the case that the correlation destruction detection process hasnot been carried out for the analyzed system with the system identifierS4, the correlation destruction detection unit 301 adds 1 to theunanalyzed times of the analyzed system 100 with the system identifierS4, and sets 0 to the unanalyzed times of the other analyzed systems100, as shown in FIG. 21.

In the correlation destruction detection process carried out for theanalyzed systems 100 with the system identifier S1 and S2, thecorrelation destruction detection unit 301 carries out the correlationdestruction detection for the performance information d13 and d23 oftime period 3 measured in the analyzed systems 100, respectively. In thecorrelation destruction detection process carried out for the analyzedsystem 100 with the system identifier S3, the correlation destructiondetection unit 301 carries out the correlation destruction detection forthe performance information d31, d32 and d33 of time period 1, 2 and 3measured in the analyzed system 100. The correlation destructiondetection unit 301 calculates the degree of abnormality of the analyzedsystems 100 with the system identifiers S1, S3 and S2 respectively, asshown in FIG. 21.

As shown in FIG. 21, the analysis order determination unit 401 assignsthe scores after multiplying the degree of correlation destruction andthe degree of signaling fault of the analyzed system with the systemidentifier S4 by 3. The analysis order determination unit 401 determinesthe detection order for the analyzed systems 100 with the systemidentifiers S1, S2, S3 and S4 as 1, 3, 4, and 2, respectively, on thebasis of a total score.

Then, in time period 4 shown in FIG. 18, the correlation destructiondetection unit 301 caries out the correlation destruction detection andcalculates the degree of abnormality in an order of the systemidentifiers S1, S4, S2 and S3 respectively.

As mentioned above, the detection order is updated in such a way thatthe correlation destruction detection for the analyzed systems with thesystem identifiers S3 and S4, which has not been carried out in timeperiod 1, is carried out preferentially in time period 2 or thereafter.

Moreover, regarding the analyzed system 100 with the system identifierS3, for which the correlation destruction detection has not been carriedout in time periods 1 and 2, the correlation destruction detection forthe performance information of time periods 1, 2 and 3 is carried outcollectively in time period 3.

As mentioned above, the correlation destruction detection process, whichis carried out by the analysis unit 300, is divided into threesub-processes, (a) acquiring the performance information and thecorrelation model 222 from the analysis control unit 200 (Steps S152 andS153), (b) carrying out the correlation destruction detection (StepS154), and (c) storing the result of the correlation destructiondetection in the analysis control unit 200 (Step S155).

Here, regarding a process time of (a) and (c), a time required forreading and writing control for accessing a storage apparatus or thelike is longer than a time required for transferring data. Therefore itis appropriate to think that a process time of (a) and (c) required inthe case of acquiring and storing the performance information of aplurality of time periods collectively, is almost equal to a processtime of (a) and (c) required in the case of acquiring and storing theperformance information of one time period. Moreover, it is appropriateto think that a process time of (b), which does not include a time foraccessing the storage apparatus or the like, is quite small incomparison with the process time of (a) and (c). In this case, a processtime for the correlation destruction detection for a plurality of thetime periods is almost equal to one for one time period.

Accordingly, it is possible to decrease a load of the correlationdestruction detection process through carrying out the correlationdestruction detection for a plurality of periods, collectively.

With this, the operation according to the second exemplary embodiment ofthe present invention is completed.

While the analysis order determination unit 401 determines the order ofthe correlation destruction detection using the value obtained throughmultiplying the degree of abnormality calculated in the time period whenthe correlation destruction detection was carried out by the unanalyzedtimes, in the second exemplary embodiment of the present invention,another method may be used, as far as it is possible to use a valuewhich is larger than the degree of abnormality calculated in the timeperiod when the correlation destruction detection was carried out as thedegree of abnormality. For example, the analysis order determinationunit 401 may multiply the degree of abnormality calculated in the timeperiod when the correlation destruction detection was carried out by apredetermined constant. Moreover, the analysis order determination unit401 may multiply the degree of abnormality calculated in the time periodwhen the correlation destruction detection was carried out by anothercoefficient which becomes large according to the unanalyzed times.

According to the second exemplary embodiment of the present invention,even if there is an analyzed system 100 for which the correlationdestruction detection has not been carried out within a time period forthe analysis because of the late detection order, it is possible tocarry out the correlation destruction detection for the analyzed system100 in the latter time period. The reason is that the analysis orderdetermination unit 401 assigns the value larger than the degree ofabnormality calculated in the former time period in which thecorrelation destruction detection was carried out, to the degree ofabnormality of the analyzed system 100 for which the correlationdestruction detection has not been carried out, and determines the orderof the correlation destruction detection on the basis of the assigneddegree of abnormality.

Moreover, according to the second exemplary embodiment of the presentinvention, it is possible to decrease a load of the correlationdestruction detection process. The reason is that the correlationdestruction detection unit 301 carries out the correlation destructiondetection not only for the performance information of the present timeperiod but also for the performance information of the former timeperiod in which the correlation destruction detection was not carriedout, collectively.

Moreover, according to the second exemplary embodiment of the presentinvention, it is possible to decrease a load of the correlationdestruction detection process with carrying out preferentially thedetection of the fault of the analyzed system 100 having a highpossibility that the fault is caused at this moment or will be caused inthe future. The reason is that the correlation destruction detection forthe analyzed system 100 having the large degree of abnormality iscarried out in each time period, preferentially, and the correlationdestruction detection for the analyzed system 100 having the smalldegree of abnormality is carried out for the performance information ofthe plural time periods, collectively.

Third Exemplary Embodiment

Next, a third exemplary embodiment of the present invention will bedescribed.

In the third exemplary embodiment of the present invention, the analysisorder determination unit 401 sets a group of the plural analyzed systems100, for which the correlation destruction detection has not beencarried out, having the large unanalyzed times, in stead of multiplyingthe degree of abnormality calculated in the time period in which thecorrelation destruction detection was carried out by the unanalyzedtimes. The analysis order determination unit 401 assigns a total of thedegrees of abnormality, each of which is calculated in the time periodin which the correlation destruction detection was carried out forcorresponding one of the plural analyzed systems 100 included in thegroup, to the degree of abnormality of each analyzed system 100 includedin the group, and determines the order of the correlation destructiondetection on the basis of the assigned degree of abnormality.

A configuration of the third exemplary embodiment of the presentinvention is similar to one according to the second exemplary embodimentof the present invention (FIG. 15).

Next, an operation of an operations management system 1 according to thethird exemplary embodiment of the present invention will be described. Aflowchart, which shows a process carried out by the operationsmanagement system 1 according to the third exemplary embodiment of thepresent invention, is similar to one according to the second exemplaryembodiment of the present invention (FIG. 16).

FIG. 22 is a diagram showing an example of a correlation destructiondetection process carried out in each time period according to the thirdsecond exemplary embodiment of the present invention. Each of FIG. 23,FIG. 24 and FIG. 25 is a diagram showing an example of calculating adetection order according to the third exemplary embodiment of thepresent invention.

For example, in time period 1 shown in FIG. 22, the correlationdestruction detection unit 301 carries out the correlation destructiondetection and calculates the degree of abnormality in an order of thesystem identifiers S1, S2, S3 and S4 respectively, according to theanalysis order information 422 shown in FIG. 11.

Here, in the case that the correlation destruction detection process hasnot been carried out for the analyzed systems 100 with the systemidentifiers S3 and S4, the correlation destruction detection unit 301adds 1 to the unanalyzed times of the analyzed systems 100 with thesystem identifiers S3 and S4 and sets 0 to the unanalyzed times of theother analyzed systems, as shown in FIG. 23.

In the correlation destruction detection process carried out for theanalyzed systems 100 with the system identifiers S1 and S2, thecorrelation destruction detection unit 301 carries out the correlationdestruction detection for the performance information d11 and d21 oftime period 1 measured in the analyzed systems 100, respectively. Thecorrelation destruction detection unit 301 calculates the degree ofabnormality of the analyzed systems 100 with the system identifier S1and S2 respectively, as shown in FIG. 23.

Here, it is assumed, as a condition of setting the group, that apredetermined number of the analyzed systems 100 having the largestvalue of unanalyzed times from the analyzed systems 100 for which thecorrelation destruction detection has not been carried out are includedin a group, for example. Moreover, it is assumed that the predeterminednumber is 2.

In this case, as shown in FIG. 23, the analysis order determination unit401 sets a group of the analyzed systems 100 with the system identifiersS3 and S4 whose unanalyzed times is 1. The analysis order determinationunit 401 assigns a value obtained through adding the degrees ofcorrelation destruction of the analyzed systems 100 with the systemidentifiers S3 and S4 to the degree of correlation destruction of theanalyzed systems 100 with the system identifiers S3 and S4. Moreover,the analysis order determination unit 401 assigns a value obtainedthrough adding the degrees of signaling fault of the analyzed systems100 with the system identifiers S3 and S4 to the degree of signalingfault of the analyzed systems 100 with the system identifiers S3 and S4.Then, the analysis order determination unit 401 calculates scores and atotal score. The analysis order determination unit 401 determines thedetection order for the analyzed systems 100 with the system identifiersS1, S2, S3 and S4 as 1, 4, 2, and 3, respectively, on the basis of thetotal score. Note that, the detection order of the analyzed system 100within the group is determined in such a way that the correlationdestruction detection may be carried out early for the analyzed system100 which has the large degree of abnormality or the large degree ofsignaling fault.

Then, in time period 2 shown in FIG. 22, the correlation destructiondetection unit 301 carries out the correlation destruction detection andcalculates the degree of abnormality in the order of the systemidentifiers S1, S3, S4 and S2 respectively.

Here, in the case that the correlation destruction detection process hasnot been carried out for the analyzed systems with the systemidentifiers S3, S4 and S2, the correlation destruction detection unit301 add 1 to the unanalyzed times of the analyzed systems 100 with thesystem identifier S3, S4 and S2, and sets 0 to the unanalyzed times ofthe other analyzed systems, as shown in FIG. 24.

In the correlation destruction detection process carried out for theanalyzed system 100 with the system identifier S1, the correlationdestruction detection unit 301 carries out the correlation destructiondetection for the performance information d12 of time period 2 measuredin the analyzed system 100. The correlation destruction detection unit301 calculates the degree of abnormality of the analyzed system 100 withthe system identifier S1, as shown in FIG. 24.

As shown in FIG. 24, the analysis order determination unit 401 sets agroup of the analyzed systems 100 with the system identifiers S3 and S4whose unanalyzed times is 2, and assigns scores. The analysis orderdetermination unit 401 determines the detection order for the analyzedsystems 100 with the system identifiers S1, S2, S3 and S4 as 1, 4, 2,and 3, respectively, on the basis of the total score.

Then, in time period 3 shown in FIG. 22, the correlation destructiondetection unit 301 carries out the correlation destruction detection andcalculates the degree of abnormality in the order of the systemidentifiers S1, S3, S4 and S2, respectively.

Here, in the case that the correlation destruction detection process hasnot been carried out for the analyzed system 100 with the systemidentifier S2, the correlation destruction detection unit 301 adds 1 tothe unanalyzed times of the analyzed system 100 with the systemidentifier S2, and sets 0 to the unanalyzed times of the other analyzedsystems 100, as shown in FIG. 25

In the correlation destruction detection process carried out for theanalyzed system 100 with the system identifier S1, the correlationdestruction detection unit 301 carries out the correlation destructiondetection and calculates the degree of abnormality for the performanceinformation d13 of time period 3 measured in the analyzed system 100. Inthe correlation destruction detection process carried out for theanalyzed systems 100 with the system identifiers S3 and S4, thecorrelation destruction detection unit 301 carries out the correlationdestruction detection and calculates the degree of abnormality for theperformance information d31, d32 and d33, and d41, d42 and d43 of timeperiod 4 measured in the analyzed systems 100. The correlationdestruction detection unit 301 calculates the degree of abnormality ofthe analyzed systems 100 with the system identifiers S1, S3 and S4respectively, as shown in FIG. 25.

As shown in FIG. 25, the analysis order determination unit 401 assignsscores, and determines the detection order for the analyzed systems 100with the system identifiers S1, S2, S3 and S4 as 1, 2, 3, and 4,respectively, on the basis of a total score.

As mentioned above, the detection order is updated in such a way thatthe correlation destruction detection, which has not been carried out intime period 1 for the analyzed systems with the system identifiers S3and S4, is carried out preferentially in time period 2 or thereafter.

With this, the operation according to the third exemplary embodiment ofthe present invention is completed.

While the analysis order determination unit 401 sets the group whichincludes the predetermined number of the analyzed systems 100 having thelargest value of the unanalyzed time from the analyzed systems 100 forwhich the correlation destruction detection has not been carried out, inthe third exemplary embodiment of the present invention, another methodmay be used, as far as it is possible to set a group of the analyzedsystems having the large value of the unanalyzed times. For example, theanalysis order determination unit 401 may set a group of the analyzedsystems whose unanalyzed times is equal to or greater than apredetermined value.

While the invention has been particularly shown and described withreference to exemplary embodiments thereof, the invention is not limitedto these embodiments. It will be understood by those of ordinary skillin the art that various changes in form and details may be made thereinwithout departing from the spirit and scope of the present invention asdefined by the claims.

For example, when the analysis unit 300 determines the detection order,the analysis unit 300 may use both of the method using the valueobtained through multiplying the degree of abnormality by thepredetermined coefficient according to the second exemplary embodimentof the present invention, and the method using a total of the degrees ofabnormality through setting a group of the analyzed systems 100according to the third exemplary embodiment of the present invention.

This application is based upon and claims the benefit of priority fromJapanese Patent Application No. 2011-064603, filed on Mar. 23, 2011, thedisclosure of which is incorporated herein in its entirety by reference.

REFERENCE SIGNS LIST

1 Operations management system

100 Analyzed system

200 Analysis control unit

201 Performance information collecting unit

202 Correlation model generating unit

203 Administrator interaction unit

204 Countermeasure execution unit

211 Performance information storing unit

212 Correlation model storing unit

213 Correlation destruction storing unit

214 Correlation destruction pattern storing unit

221 Performance sequence information

222 Correlation model

223 Correlation destruction information

224 Correlation destruction pattern

300 Analysis unit

301 Correlation destruction detection unit

400 Order control unit

401 Analysis order determination unit

411 Degree of abnormality storing unit

412 Analysis order storing unit

413 Unanalyzed system storing unit

421 Degree of abnormality information

422 Analysis order information

What is claimed is:
 1. An operations management system, comprising: acorrelation model storing unit which stores a correlation model whichindicates a correlation among plural types of performance values, foreach of plural systems; an analysis order storing unit which stores asequence in said plural systems for carrying out detection of acorrelation destruction; an analysis unit which carries out, in each ofplural time periods, detection of whether said correlation destructionof said correlation included in said correlation model of each of saidplural systems is caused by use of performance values inputted for saideach of plural time periods, according to said sequence; and an ordercontrol unit which updates said sequence in said each of plural timeperiods, in such a way that said detection for a system on which saidcorrelation destruction has been caused carried out earlier than saiddetection for a system on which said correlation destruction has notbeen caused, wherein said order control unit determines said sequencebased on a result of said detection of whether said correlationdestruction is caused in each of said plural systems, wherein said ordercontrol unit determines said sequence by use of a degree of abnormalitywhich is derived from at least one of a degree of correlationdestruction calculated on a basis of a number of destructed correlationsincluded in said result of said detection, and a degree of similaritybetween said result of said detection obtained when a fault is caused insaid system and said result of said detection on said inputtedperformance values, and wherein, in a case that said detection has notbeen carried out for one of said plural systems in one of said pluraltime periods, said order control unit sets a value greater than saiddegree of abnormality which was calculated in a time period in whichsaid detection was carried out for said one of said plural systems,before said one of said plural time periods, to said degree ofabnormality of said one of said plural systems.
 2. The operationsmanagement system according to claim 1, wherein said order control unitsets a value obtained through multiplying said degree of abnormalitywhich was calculated in a time period in which said detection wascarried out for said one of said plural systems, before said one of saidplural time periods, by a coefficient becoming greater according to anumber of time periods in which said detection was not carried out, tosaid degree of abnormality of said one of said plural systems.
 3. Theoperations management system according to claim 1, wherein said ordercontrol unit generates a group of plural systems whose number of timeperiods in which said detection was not carried out is greater thanother systems, and sets a total of said degrees of abnormality, each ofwhich was calculated in a time period when said detection was carriedout for a corresponding one of said plural systems included in saidgroup, before said one of said plural time periods, to said degree ofabnormality of each of said plural systems included in said group. 4.The operations management system according to claim 1, wherein, in acase that said analysis unit carries out said detection in each of saidplural time periods, said analysis unit carries out said detection byuse of not only said performance values inputted for said each of saidplural time periods but also said performance values inputted for a timeperiod in which said detection was not carried out, before said each ofsaid plural time periods.
 5. The operations management system accordingto claim 1, wherein said sequence includes a plurality of systemidentifier, respectively, in an order of a degree of correlationdestruction in the plural systems.
 6. The operations management systemaccording to claim 1, wherein an invariant analysis based on thecorrelation destruction is performed on each of the plural system,sequentially.
 7. An operations management method, comprising: storing acorrelation model which indicates a correlation among plural types ofperformance values, for each of plural systems; storing a sequence insaid plural systems for carrying out detection of a correlationdestruction; carrying out, in each of plural time periods, detection ofwhether said correlation destruction of said correlation included insaid correlation model of each of said plural systems is caused by useof performance values inputted for said each of plural time periods,according to said sequence; and updating said sequence in said each ofplural time periods, in such a way that said detection for a system onwhich said correlation destruction has been caused carried out earlierthan said detection for a system on which said correlation destructionhas not been caused, wherein said updating said sequence determines saidsequence based on a result of said detection of whether said correlationdestruction is caused in each of said plural systems, wherein saidupdating said sequence determines said sequence by use of a degree ofabnormality which is derived from at least one of a degree ofcorrelation destruction calculated on a basis of a number of destructedcorrelations included in said result of said detection, and a degree ofsimilarity between said result of said detection obtained when a faultis caused in said system and said result of said detection on saidinputted performance values, and wherein, in a case that said detectionhas not been carried out for one of said plural systems in one of saidplural time periods, a value greater than said degree of abnormalitywhich was calculated in a time period in which said detection wascarried out for said one of said plural systems, before said one of saidplural time periods, is set to said degree of abnormality of said one ofsaid plural systems.
 8. The operations management method according toclaim 7, wherein a value obtained through multiplying said degree ofabnormality which was calculated in a time period in which saiddetection was carried out for said one of said plural systems, beforesaid one of said plural time periods, by a coefficient becoming greateraccording to a number of time periods in which said detection was notcarried out, is set to said degree of abnormality of said one of saidplural systems.
 9. The operations management method according to claim7, wherein a group of plural systems whose number of time periods inwhich said detection was not carried out is greater than other systemsis generated, and a total of said degrees of abnormality, each of whichwas calculated in a time period when said detection was carried out fora corresponding one of said plural systems included in said group,before said one of said plural time periods, is set to said degree ofabnormality of each of said plural systems included in said group. 10.The operations management method according to claim 7, wherein, in acase that said detection in each of said plural time periods is carriedout, said detection by use of not only said performance values inputtedfor said each of said plural time periods but also said performancevalues inputted for a time period in which said detection was notcarried out, before said each of said plural time periods, is carriedout.
 11. A non-transitory computer readable storage medium recordingthereon a program, causing a computer to perform a method comprising:storing a correlation model which indicates a correlation among pluraltypes of performance values, for each of plural systems; storing asequence in said plural systems for carrying out detection of acorrelation destruction; carrying out, in each of plural time periods,detection of whether said correlation destruction of said correlationincluded in said correlation model of each of said plural systems iscaused by use of performance values inputted for said each of pluraltime periods, according to said sequence; and updating said sequence insaid each of plural time periods, in such a way that said detection fora system on which said correlation destruction has been caused carriedout earlier than said detection for a system on which said correlationdestruction has not been caused, wherein said updating said sequencedetermines said sequence based on a result of said detection of whethersaid correlation destruction is caused in each of said plural systems,wherein said updating said sequence determines said sequence by use of adegree of abnormality which is derived from at least one of a degree ofcorrelation destruction calculated on a basis of a number of destructedcorrelations included in said result of said detection, and a degree ofsimilarity between said result of said detection obtained when a faultis caused in said system and said result of said detection on saidinputted performance values, and wherein, in a case that said detectionhas not been carried out for one of said plural systems in one of saidplural time periods, a value greater than said degree of abnormalitywhich was calculated in a time period in which said detection wascarried out for said one of said plural systems, before said one of saidplural time periods, is set to said degree of abnormality of said one ofsaid plural system.
 12. The non-transitory computer readable storagemedium according to claim 11, recording thereon said program causingsaid computer to perform said method, wherein a value obtained throughmultiplying said degree of abnormality which was calculated in a timeperiod in which said detection was carried out for said one of saidplural systems, before said one of said plural time periods, by acoefficient becoming greater according to a number of time periods inwhich said detection was not carried out, is set to said degree ofabnormality of said one of said plural systems.
 13. The non-transitorycomputer readable storage medium according to claim 11, recordingthereon said program causing said computer to perform said method,wherein a group of plural systems whose number of time periods in whichsaid detection was not carried out is greater than other systems isgenerated, and a total of said degrees of abnormality, each of which wascalculated in a time period when said detection was carried out for acorresponding one of said plural systems included in said group, beforesaid one of said plural time periods, is set to said degree ofabnormality of each of said plural systems included in said group. 14.The non-transitory computer readable storage medium according to claim11, recording thereon said program causing said computer to perform saidmethod, wherein, in a case that said detection in each of said pluraltime periods is carried out, said detection by use of not only saidperformance values inputted for said each of said plural time periodsbut also said performance values inputted for a time period in whichsaid detection was not carried out, before said each of said plural timeperiods, is carried out.
 15. An operations management system,comprising: correlation model storing means for storing a correlationmodel which indicates a correlation among plural types of performancevalues, for each of plural systems; analysis order storing means forstoring a sequence in said plural systems for carrying out detection ofa correlation destruction; analysis means for carrying out, in each ofplural time periods, detection of whether said correlation destructionof said correlation included in said correlation model of each of saidplural systems is caused by use of performance values inputted for saideach of plural time periods, according to said sequence; and ordercontrol means for updating said sequence in said each of plural timeperiods, in such a way that said detection for a system on which saidcorrelation destruction has been caused carried out earlier than saiddetection for a system on which said correlation destruction has notbeen caused, wherein said order control means determines said sequencebased on a result of said detection of whether said correlationdestruction is caused in each of said plural systems, wherein said ordercontrol means determines said sequence by use of a degree of abnormalitywhich is derived from at least one of a degree of correlationdestruction calculated on a basis of a number of destructed correlationsincluded in said result of said detection, and a degree of similaritybetween said result of said detection obtained when a fault is caused insaid system and said result of said detection on said inputtedperformance values, and wherein, in a case that said detection has notbeen carried out for one of said plural systems in one of said pluraltime periods, said order control means sets a value greater than saiddegree of abnormality which was calculated in a time period in whichsaid detection was carried out for said one of said plural systems,before said one of said plural time periods, to said degree ofabnormality of said one of said plural systems.